The U.S. National Security Agency (NSA) has warned organizations and individuals of the dangers of using broadly-scoped certificates to authenticate multiple servers in an organization.
Previously, researchers have shown that Transport Layer Security (TLS) servers running different protocols with compatible certificates such as wildcard and multi-domain could be exploited by an Application Layer Protocols Allowing Cross-Protocol Attack (ALPACA), which could allow attackers to steal cookies or conduct cross-site scripting attacks.
According to the NSA, “ALPACA is a complex class of exploitation techniques that can take many forms,” and in order to achieve its goal, it needs a targeted web application that uses TLS. TLS is another service/application that provides a valid TLS certificate with a subject name that would be for the targeted web app, a means for the malicious actor to redirect the network traffic of the target application to the second service, and an HTTP request that is accepted by the second service.
The NSA, therefore, recommended that organizations protect the private key of a wildcard certificate and keep it on a well-maintained server to avoid the risk of attackers obtaining it by compromising a poorly secured machine.
For more information, read the original story in BleepingComputer.